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ABSTRACT 


NASA has been funding an ongoing development program to characterize the explosive 
environments produced during a catastrophic launch vehicle accident. These studies and small-scale 
tests are focused on the near field environments that threaten the crew. The results indicate that these 
environments are unlikely to result in immediate destruction of the crew modules. The effort began as an 
independent assessment by NASA safety organizations, followed by the Ares program and NASA 
Engineering and Safety Center and now as a Space Launch Systems (SLS) focused effort. The 
development effort is using the test and accident data available from public or NASA sources as well as 
focused scaled tests that are examining the fundamental aspects of uncontained explosions of Hydrogen 
and air and Hydrogen and Oxygen. The primary risk to the crew appears to be the high-energy fragments 
and these are being characterized for the SLS. The development efforts will characterize the thermal 
environment of the explosions as well to ensure that the risk is well understood and to document the 
overall energy balance of an explosion. The effort is multi-path in that analytical, computational and 
focused testing is being used to develop the knowledge to understand potential SLS explosions. This is 
an ongoing program with plans that expand the development from fundamental testing at small-scale 
levels to large-scale tests that can be used to validate models for commercial programs. The ultimate goal 
is to develop a knowledge base that can be used by vehicle designers to maximize crew survival in an 
explosion. 


INTRODUCTION 


The Launch Vehicle Blast Environments study is an ongoing effort to characterize the 
environments resulting from catastrophic launch vehicle explosion. The purpose is to develop the data 
and information required to allow launch vehicle and crew systems designers to develop safer crewed 
launch systems. This paper is a high level summary of the activities, early results and plans of the project. 
Detail data is provided in a series of papers that address both the liquid propellant launch vehicles and 
solid boosters. The more detailed papers address the blast physics, the fragments that are generated and 
accelerated and the thermal aspects of the explosions that can be produced. The effort is continuing but 
some early observations can be made about how they might impact future vehicle designs. 

This work is focused on the near field effects of the explosions. This is the least studied region 
and is of direct influence to the crew. Higher fidelity analysis is required to adequately define the risk to 
the crew and to understand possible impacts to the crew systems involved in protecting and rescuing the 
crew. All phases of the ascent are being addressed but current efforts have focused on the pad and near 
pad regions since there is more data available and the magnitude of the blast overpressures is increased 
due to ground reflections. These results can be used to inform the ground environments but additional 
work is required to ensure the safety of ground crews due to the susceptibility of unprotected humans to 
the environments. 



This effort has been ongoing for over four years and was started as the result of an independent 
assessment by the NASA Marshall Space Flight Center (MSFC) to define the blast environments and to 
assess if the existing requirements were adequate. The Ares program office provided subsequent funding 
and then a focused study on liquid propellant launch vehicles was assigned to the NASA Engineering and 
Safety Center (NESC) out of Langley Research Center. The Space Launch System program provides the 
current funding and is now focused on Hydrogen/Oxygen propellants and the solid rocket boosters. Table 
1 provides a summary of the project sponsors and the primary goals and emphasis. 


Customer 

Time Frame 

Focus / Goals 

Independent Assessment 
(MSFC S&MA) 

2011 

Define requirements for blast environments to assess current 
program requirements 

Ares Program Office 

2012 

Identify governing physics based on test and accident data for both 
liquids and solids 

NESC NASA Engineering 
and Safety Center 

2013 

Focus on liquids and develop a test program, small scale testing was 
funded 

SLS Space Launch 
Systems 

2014 

Focus narrowed to Hydrogen/Oxygen propellants and added Solids 
to assessment 


Table 1 - Project Funding / Customer that have Sponsored this Effort 

The program so far has relied on prior work and some small scale testing. There have been some 
excellent test programs conducted in the past including: Project PYRO [1], Hydrogen / Oxygen Vertical 
Impact Test (HOVI) [2], Large Scale Hydrogen Oxygen Experiment and several others. Accident data was 
a good source of information but is limited due to the sparse data recovered. The emphasis on accident 
investigation to date has been on the root failure cause of the accidents and not the results of the blast 
and fragment dispersions. Even today the accident investigations focus on the failure causes and tend to 
overlook data that can be easily obtained from the resulting fragment populations and blast effects. While 
individual accidents provide data to support insight, a collection of accidents can indicate trends. 

One of the findings from the NESC reviews determined that efforts going forward should integrate 
testing and engineering analysis with computational efforts that are already underway. As a result the 
SLS program integrated computational/test/analysis efforts. Computational efforts here include both 
Computational Fluid Dynamics (CFD) as well as Fluid Structure Interaction (FSI) simulations. FSI 
solutions are coupled CFD and Finite Element Method (FEM) solutions that can provide insight as to how 
the structures will react under dynamic loads. Current efforts involve both CFD and FSI solutions that are 
being used to develop in-depth understanding of the test results that are being obtained. 

Early investigations indicated that all of the data available was very inconsistent and that there 
were significant variations within a given test program and between different test programs. Some of this 
is expected in that the test programs targeted different aspects of the explosions and involved very 
different configurations. These test programs were well conceived for their specific purpose and executed 
with proper test practices but the configuration of the tests involved multiple test factors that complicate 
the detailed analysis of the results. When the tests were examined as a single body of work the variances 
between test configurations and the variances within the test programs themselves create a challenge for 
data interpretation efforts. One insight gained from the narratives within the test reports was that the 
magnitudes of blast overpressures were inconsistent with TNT explosions, which were used to define the 
explosions at that time. Some of these insights provided guidance for our team to expand on the work 
that was performed. 

All of the publically available data was examined in-depth to develop a model for the launch 
vehicle blasts. A large number of tests and some accident data were analyzed and a clear trend was 
discovered and documented in 201 1 . This led the team to develop some path-finding small-scale tests 
where weakly contained hydrogen/oxygen and hydrogen/air mixtures could be ignited at various mixture 
ratios. These tests were needed to validate the trends that were extracted from the test and accident 
data. A second series of path-finding tests were done to examine aspects of the fragmentation process — 




including generation and acceleration of the fragments. These early path-finding tests led to more formal 
and rigorous testing. 

The SLS program revived the work on the solid rocket motor blast environments. This resulted in 
the development of a model that is based on the chamber pressure and volume. Research indicates that 
the solid propellant does not participate in the blast event for situations involving crew survivability. This 
excludes high-speed impacts and ignitions by high-energy charges. This finding is consistent with DOD 
experience with both small and large solid rocket motors. The SRB’s operate at pressures that can 
exceed 1000 psia at ignition. Catastrophic failures or case bursts can approach pressures close to 2000 
psia. Comparisons with solid rocket motor tests of FTS events compare well to a pressure -volume gas 
rapid release. Solid Rocket Motors of large enough size can produce fragments with much higher kinetic 
energies than the liquid systems. This makes the SLS SRB a key part of the risk assessment. 

There is a significant difference in the philosophy, objectives and approach of this work from the 
Air Force Range Group. Highly conservative assumptions in the Range assessments provide for superior 
protection for the public and facilities near launch sites. These same highly conservatism assumptions 
will not serve the crew well because it can overemphasize risks that are not, in fact, risks to the crew. This 
approach will predict that it is unlikely for the crew to survive even minor explosions. This hides risks that 
may ultimately put the crew in danger when the crew modules does survive and the crew safety systems 
are unprepared for the consequences. It is these kinds of differences that led NASA and this team to 
investigate the near field blast environment in more detail. 

RESULTS AND DISCUSSION 


This paper is organized in four subsections below, beginning with the anatomy of an explosion. 
That section provides a summary of the work and findings for defining hydrogen/oxygen explosions along 
with some data provided for RP fuels. The next section addresses the generation of fragments and 
provides some overview of the velocities of the fragments produced. The section on thermal aspects of 
fireballs is relatively shallow at this time due to lower maturity of the work to date. The final discussion 
section provides an overview of the near term plans as well as some look ahead to larger scale testing 
that is highly desired but not yet funded. 

For the work herein there are four aspects of an explosion that are being investigated to describe 
the explosions. The variables are described in Table 2 [1] below and consist of mechanical (blast), 
fragmentation, thermal (fireball), and time. These variables are used to describe the effects on the vehicle 
and crew systems but are insufficient to describe the physics of the explosions. 


Type 

Variable 

Description 

Mechanical 

P(x) 

Overpressure as a function of distance 

l(x) 

Impulse as a function of distance 

v(x,t) 

Blast wave speed as a function of distance and time 

Fragmentation 

m 

Fragmentation mass distribution 

VO 

Initial fragmentation velocity distribution 

A 

Cross-sectional fragmentation area distribution 

# 

Number of fragments as a function of volume 

Thermal 

r(t) 

Fireball radius as a function of time 

T(t) 

Fireball temperature as a function of time 

Temporal 

ta 

Time of abort trigger till first blast wave 


Table 2 - Variables used to Describe Launch Vehicle Explosions 


This work is being done to define the environments that can be produced. System models such 
as Ames Research Center (ARC) Engineering Risk Assessment (ERA) models are required to apply the 
possible environments to the vehicle configuration, state, and potential failure modes. This effort is to 
obtain the data to improve and validate these simulations and to provide future vehicle designers with the 
knowledge to eliminate conditions that prevent the crew safety systems from functioning as designed. 

The trends being demonstrated for the SLS program indicate that the blast waves are not the primary 
threat from explosions to crew safety due to lower overpressures now being predicted and the distance 
between the center of any possible SLS explosion and the crew module. Highly unlikely scenarios are 
being assumed that do present a risk when detonations occur near the crew module. However, the high- 
speed fragments generated by a segment or booster explosion represent a risk that influences the loss of 
crew predications. Efforts described herein are to integrate fragment production and acceleration with the 
blast mechanical aspects including the overpressures, flame/wave speeds, radius and timing. 

Significant work has gone into developing an approach for defining the fragments that are 
produced and how they are accelerated. The process uses a set of heuristics or rules to define how the 
various structures will breakup based on prior accidents and tests. This is done for each major structural 
segment. Examples of a segment include the aft skirt with the major propulsion elements, the hydrogen 
tank, the oxygen tank, the inter-stage, and so on. The nature of each unique structure is accounted for in 
the generation of the fragments using this approach. 

The study of the long duration fireball represents the thermal efforts now underway. The fireballs 
are the large fires that may last 10’s of seconds. The team differentiates between the initial blast, 
sometime referred to as the luminous boundary and the fireball that follows the initial blast event. The 
crew capsules are designed for high-speed reentry and therefore get exposed to very high heat rates. 

The fireball temperatures are actually less than what most capsules are designed to accommodate and 
the durations are less than the reentry periods. Therefore this work was considered secondary as a threat 
to the crew but is beginning to mature. 

Timing is a very important consideration in any launch vehicle accident. Today’s abort systems 
are designed to sense and recommend or initiate an abort in milliseconds. The actual timing of the onset 
of the blast and production of the blast waves and fragments will influence the amount of risk to the crew. 
If sufficient time exists then the crew or on-board systems can activate the escape sequence and propel 
the crew modules some distance away from the vehicle, increasing the safety of the crew. Therefore, 
understanding the timing of these accidents is a key aspect and is being undertaken to provide vehicle 
designers benchmarks to design abort logic/recommendations. 

One aspect that the team discovered early in the research was that the community used vehicle 
accidents and tests that consisted of events or configurations that were designed to produce high energy 
explosions as part of the databases used to characterize the launch vehicle explosions. Solid Rocket 
Motors were tested to assess the consequences of being destroyed by high-energy explosions that may 
come from an incoming weapons system. These events were not considered to represent a survivable 
accident. Solid rocket motors can detonate form high-speed impacts. The kinetic energy required is a 
function of the grain/chemistry-of the particular motor which will define a characteristic depth when a 
detonation can occur. This scenario was ruled out of consideration since it is highly likely that the crew or 
the onboard abort logic would initiate an escape well before the vehicle turned around and accelerated 
toward the ground. Therefore tests or accidents that involved high-speed impacts with the ground were 
not considered. Other cases not considered included destruct demonstrations that used large quantities 
of high energy explosives that were designed to detonate the propellants. These kinds of filters were 
applied to all of the accidents and tests that were used in developing the models and algorithms that were 
created. In addition, the team uses the SLS vehicle Probability Risk Assessments (PRA) to eliminate 
cases, which are so improbable that they do not justify the investment to address in detail. 


ANATOMY OF AN EXPLOSION 



Explosions are a complex multidisciplinary problem that involves combustion, fluid dynamics, 
thermodynamics, structures / fluid interaction, and shock physics for high-speed flows. Adding to that 
complexity is that the areas of concern are accidents. Accidents, by their very nature, make it difficult to 
predict when and where the failures occur that generate an explosion. The launch vehicle makes this 
even more complex in that the vehicle is accelerating upward with the atmospheric conditions changing 
with altitude and vehicle velocities. In the past, the designers of the crew safety systems and launch 
vehicle designers have used worst-case assumptions to define the potential explosions and fragment risk 
in an attempt to envelope the environments. These assumptions tend to use similarity to well-known 
phenomena, such as TNT blasts, where there is a very large knowledge base on the blast generation and 
effects. 


This body of [3] work clearly shows that the use of TNT as the basis of the blast does not 
represent the actual physics of launch vehicle explosions. The TNT event is a high-energy explosion that 
produces huge overpressures that are measured in thousands of psia. The TNT representation can 
match the blast overpressure at a single distance but the impulse will be different at that distance. The 
data shows that the peak overpressure for hydrogen and oxygen mixture will be limited to no more than 
482 psia. This value is for highly constrained environments and has only been produced in shock tubes. 
This data matches the Zeldovich-von Neumann-Doring [4] theory. Such high magnitudes of 
overpressures are highly unlikely to occur on a launch vehicle but the upper limit here is clearly several 
orders of magnitude lower than the near field overpressures that are produced by TNT or other high 
energy explosions. TNT and similar high energy explosions create near field blast overpressures that are 
not survivable by current launch vehicle/crew module designs or technologies. 

Relatively low overpressures can cause launch vehicle destruction. One must recognize that* 
when the source is large volumes of exploding gas* even small overpressures become major loads on the 
vehicle. The data in Table 3 provides some insight to the level of damage expected from low 
overpressures. 


Overpressure* 

(psig) 

Expected Damage 

0.04 

Loud noise (143 db); sonic boom glass failure. 

0.15 

Typical pressure for glass failure. 

0.40 

Limited minor structural damage. 

0.50-1.0 

Windows usually shattered; some window frame damage. 

0.70 

Minor damage to house structures. 

1.0 

Partial demolition of houses; made uninhabitable. 

1. 0-8.0 

Range for slight to serious laceration injuries from flying glass and other missiles. 

2.0 

Partial collapse of walls and roofs of houses. 

2. 0-3.0 

Non-reinforced concrete or cinder block walls shattered. 

2.4-12.2 

Range for 1-90% eardrum rupture among exposed populations. 

2.5 

50% destruction of home brickwork. 

3.0 

Steel frame buildings distorted and pulled away from foundation. 

5. 0-7.0 

Nearly complete destruction of houses. 

10.0 

Probable total building destruction. 

14.5-29.0 

Range for 1-99% fatalities among exposed populations due to direct blast effects. 


Table 3 - Level of Damage Expected at Specific Overpressures for Terrestrial Structures [5] 

Overpressures of 2 to 3 psig will destroy concrete buildings and damage steel structures. The 
values in the table are derived from high energy explosive loading. Trends for gaseous explosions would 
be similar or even greater due to the longer duration and resulting higher impulse. Shock loads can be 
very high when the small overpressures are integrated over the large surface areas of the launch vehicles 
surfaces. Loads of 200K to 300K pounds of force on the launch vehicle structures would be 
representative of an explosions of 2 psi over 30 degrees of surface of a single tank. This magnitude of 
blast load on a lightweight structure in paths/directions that are not designed to accommodate them can 
easily lead to the destruction of the vehicle. 


Crew modules tend to be robust structures that carry large dynamic, static and pressure loads to 
and from space. Typical capabilities for accommodating overpressures are expected to withstand greater 
than 10 psig. The capability of any particular crew module to accommodate overpressures is design- 
specific. Most launch vehicle designs to-date have used other launch vehicle loads such as the hoop 
stresses, axial loads during ascent, or bending loads due to pitching or wind gusts to drive the design. 
Design capabilities for overpressures and impulse loads are not a design parameter but a resultant of the 
capabilities achieved by designing to the vehicle loads. In most cases the capabilities to accommodate 
overpressures are specified on the crew module to be greater than 10 psia for overpressures but there 
are no design loads for overpressures for the launch vehicle design. 

For this work an explosion is defined as a rapid release of energy and an increase in volume that 
can generate high temperature gases. Supercritical cryogenic explosions were examined but have been 
ruled out for hydrogen/oxygen or RP/oxygen mixtures due to the operational temperatures and purity of 
the propellants used. 

Figure 1 shows the basic regions of explosions in the context of an accident. The event is assumed to be 
chaotic; therefore, the mixing of the propellants will be chaotic as well. We expect to see small regions 
that may produce stoichiometric mixtures while most regions will be fuel rich or lean or may even fall out 
of the flammable ranges for the fuels involved. The explosion/blast is produced in the first 1 to 5 
milliseconds while the long duration fireball may last 10 or more seconds. The fireball is a slow 
combustion event that will not produce blast waves but will produce a large amount of thermal energy. 

Our current models assume homogenous mixtures for a given explosion. The ability to mix well 
determines the probability of a high overpressure/impulse while the failures that lead to poor mixing will 



Figure 1 - Notional Regions of a Launch Vehicle Explosion 


produce lower overpressures and impulse. This is addressed in the system models by assigning 
probabilities to the mixing cases by defining the overpressure values. The mixing assumptions can be 
handled at the system models level as probabilities of occurrence. The goal here is to provide the 
fundamental inputs to the system models including a basis for the probability distributions of the blast 
overpressure and impulses. 

The typical explosion for liquid propellants is a deflagration or a subsonic combustion of the 
propellants or the fuel with air. Data obtained from testing and several pad accidents indicates the blast 
waves are acoustic in nature. Detonations, in this context, are combustions that propagate at supersonic 
speeds. Close examination of all of the accidents and representative tests indicate that no detonations 
have ever occurred with hydrogen/oxygen or RP/oxygen for accidents or tests representative of launch 
vehicles. However, we are defining requirements for crewed vehicles so the lack of any occurrence is 
insufficient to rule them out. Detonations must be ruled out by other means, such as a detailed 
understanding of what generates a detonation and what factors can be designed out of the vehicles to 
ensure that no detonations can occur. The current state of knowledge available to this team is not 
sufficient to exclude detonations. The current blast overpressure and impulse models assume 
detonations as the upper limit. The mean or most likely overpressure level used is still very conservative 
based on data. 


The peak pressure used for the hydrogen-oxygen explosions is based on the steady state 
detonation pressure profile prediction given in the one dimensional Zeldovich-von Neumann-Doring 
(ZND) theory [4, 6, 7], This theory, created during the early 1940’s, assumes that the detonation wave 
can be represented by a planar shock wave, an induction region, and a reaction zone. The peak pressure 
exists only in the induction region while the reaction zone decreases to the Chapman-Jouguet (CJ) 
pressure. The Chapman-Jouguet theory was a steady state theory developed early in the 20 th century 
and considered only the initial and final states of a detonation wave, at chemical equilibrium, ignoring 
chemical kinetic processes occurring within the detonation wave. CJ theory may be used to compute the 
steady state propagation speed of the detonation. The model can be developed algebraically and an 
example of its use is given in [4], ZND profiles for Hydrogen-Oxygen detonations may be found in [6,7], 

CJ and ZND properties for fuels including Hydrogen, Propane and Ethylene have been tabulated by the 
Explosion Dynamics Laboratory at the California Institute of Technology [8], Many researchers have 
considered hydrogen explosion and the possibility of detonation. Literature reviews covering hydrogen 
explosion phenomena have been written [9,10,1 1]. CJ and ZND pressures may be found from 
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In practice the only hydrogen detonations obtained in the literature appears highly constrained in 
shock tube tests. These are not representative of known launch vehicle explosions. 

The current cryogenic blast overpressure model is provided in Figure 2. Detailed discussions of 
this model can be found in references 12 and 13. Several observations can be made of this model — first 
the theoretical maximum is defined by the ZND theory at 480 psia for hydrogen/oxygen mixtures. The 
radius is a key attribute of this model in that it directly influences the effective distance that a fragment 
could be accelerated. The radius is limited by auto-ignition phenomena as defined by Farber [14] that 
indicates for hydrogen/oxygen cryogenic propellants the critical mass limit is 2300 Ibm of total propellants. 
Auto-ignition will usually occur well before the critical mass and the 2300 Ibm sets an upper limit. The 
launch vehicle environment provides a wide range of possible ignition sources ranging from electrical 
sparks, hot surfaces, plumes and pyrotechnic devices. These ignition sources will tend to ignite the 
propellants before the auto-ignition limit is achieved. After the initial blast event the decay is defined by 
the model but will be similar in shape to that of a TNT decay for the initial pressure regions. However, 



once the pressure decays beyond the knee of the curve the predicted overpressures will actually be 
higher for the liquid propellant explosions. The magnitude of the overpressures in these regions is very 
low and the differences are less than 1 psia. 
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Figure 2 - Hydrogen/Oxygen Launch Vehicle Overpressure Model 

Chemical and petroleum industries use a Vapor Cloud Explosions (VCE) model developed by 
Baker et al [15]. The model has been extensively researched and applied for over 20 years for designing 
chemical and petroleum processing facilities. The VCE model is designed for hydrocarbon/air mixtures 
and for near-surface atmospheres. Launch vehicles carry their own oxidizers and in catastrophic failures 
the fuel and oxidizer are free to mix. VCE uses an obstruction parameter to account for flame acceleration 
due to the geometry of the containment. The VCE module is a viable model for launch vehicle if applied in 
the limited areas where the containment is sufficient and atmospheric pressures are near a standard 
atmosphere. However, VCE does not account for the cryogenic explosion effects and the initial 
temperatures of the cryogenics involved. Further, the VCE model does not provide for the auto-ignition 
effect that limits the mixing with most liquid oxygen and fuels. 

As density decreases with increasing altitude, two aspects come into consideration. First the 
lower density reduces the overpressures and can be scaled by Sachs relationships [16]. This has been 
well described for high-energy explosions and considered sufficient for launch vehicle applications at this 
point in time. Second, as the atmospheric density decreases it reduces the flammability limits. At some 
point in altitude the air does not have sufficient oxygen to sustain an explosion and the only source of 
explosions to produce actual blasts are situations where the oxidizer and fuels can mix or/and an ullage 
pressure release / flash evaporation occurs. Most upper atmospheric explosions may be the result of 
flash evaporation of the propellants or the release of the internal ullage pressure and may not produce a 
meaningful blast wave. Additional work for high altitude explosions is still underway and is using 
knowledge gained from the orbital debris generation knowledge bases. 


Any launch vehicle accident is an unplanned event that will be chaotic in nature. Therefore the 
propellants’ ability to mix will be uncontrolled and a wide range of mixtures will be present in any 
explosion. Good data exists for ideal mixtures of hydrogen and air from recent testing that provides 
overpressures, flame speeds and other characteristics of the explosions. The test data comes from an 
ongoing investment in hydrogen-fueled automobiles and the interest in providing safe hydrogen fueling 
infrastructures. Hydrogen blast events are a major concern to some nuclear power systems and a large 
knowledge base was assessed. No relevant data was found for hydrogen/oxygen mixtures. The team 
elected to conduct small-scale tests to develop the overpressures/flame speed relationships for mixture 
ratios of hydrogen/oxygen with and without diluents present. The current results of this testing are 
provided in reference [3, 12] with additional testing still to be conducted. 

The testing shows a significant difference for overpressures as a function of the mixture ratios. 
The overpressures decline rapidly as the mixture becomes either fuel rich or lean. The gases have 
different viscosities, heat capacities, masses and diffusivities and it can be difficult to maintain the ideal 
mix without mechanical means. The test uses thin walled plastic bags or balloons to contain the mixture 
and recirculation pumps to mix the gases until ignition. The balloons are destroyed by either the heat or 
the expanding gas well before the flame front reaches the material. The effective internal reactant gas 
pressure prior to ignition is on the order of a 0.1 psig. 

Various balloon sizes have been tested as well as configurations with sample materials inside to 
see the effects of flame acceleration on the overall overpressures. These particular flame acceleration 
tests were conducted for path finding and more detailed testing is planned. 

Flame acceleration is a key aspect of the explosions in that Deflagration to Detonation Transition 
(DDT) is driven by flame accelerations that start subsonic and accelerate to supersonic. More testing is 
planned to address diluents, DDT, ignition by a detonating source, ignition by pressure changes, and non- 
homogenous mixtures. The overall test planning is presented later. 

While the early strategy is to envelope detonations, the risks can be further reduced if detonations 
can be eliminated from consideration. Research indicates that there are only two practical sources of 
detonations in a launch vehicle accident. The first is obstructions in and around the engines, inter-tanks or 
system tunnels where there can be a complex geometry of plumbing, structures, pressurant tanks, and 
avionics. The second is actual detonations as the initiator/igniter of a larger event. The potential sources 
are the various pyrotechnic devices on the vehicle such as separation systems or the range flight 
termination systems. The pyrotechnic devices produce high-energy shocks that can be immersed in a 
flammable mixture in an accident. These issues have not been addressed at this point and therefore the 
team will continue to use detonations as the upper bounds for the blast event until additional knowledge is 
gained. 


One clear finding of this work is that the use of high-energy blast waves does not represent the 
physics of cryogenic launch vehicle accidents. This also applies to solid rocket explosions that are 
relevant to crew safety. While it is common in the industry to use TNT as a measure of the magnitude of 
an explosion the effect on the vehicle and crew systems are considerably different. 

FRAGMENTS 


At present the preliminary evidence from the system level assessments performed by Ames 
Research Center indicates that fragments represent the primary risk to crew survivability from explosions. 
The magnitude of the risk will be configuration-dependent and changes when staging occurs or 
propellants are consumed. The SLS is an inline vehicle where the propulsion elements are below the 
crew modules. Risk to the crew for other configurations of launch vehicles will be different. Prior to this 
work most risk models used high-energy detonations as the source explosion to drive the fragments. This 
allowed the simulation to build on a large knowledge base of high-energy weapons systems development. 



Once the team established that the blast event, which drives the fragmentation generation and 
acceleration in launch vehicle explosions, was not a high energy event, then the team began to explore 
new approaches to simulating the generation of fragments and assessing the risk to the crew. 

Obviously launch vehicles accidents are not deterministic. The initiating failure, locations or the 
magnitude of the explosions occur randomly. Many other parameters come in to consideration when 
assessing the risk to the crew from fragments. One approach used across many organizations is to use 
Monte Carlo assessments where the various failure modes are used to determine the location of a blast 
and then generate the fragments from those initial assumptions. The initial assumptions are driven by the 
specific vehicle and either the failure modes and effects assessments (FMEA) or the Probability Risk 
Assessment (PRA). This is still going to be conservative but allows design teams to develop systems or 
logic to define how and when the crew should abort. The blast event is the fundamental driver in that if 
one assumes a high-energy event the resulting fragment products will have populations with a larger 
percent having higher kinetic energies. The efforts herein are an attempt to connect the blast event to the 
actual fragmentation and produce probability field functions that determine the direction and kinetic 
energy of the fragments. 

The high energy explosive knowledge base is based on a very large collection of empirical data. 
Very little of this kind of data exists for the weak, acoustic shock type phenomena seen in the launch 
vehicle blasts. The team elected to establish an initial database by the use of limited empirical data that 
was available as well as small-scale tests that could replicate the blast wave. This database supported 
the effort to determine how fragments get formed, the production of small fragments (which none of the 
empirical databases addressed) and how the fragments get accelerated. 

Reference [17] provides a detailed description of the tool developed to address the unique 
fragmentation generation and acceleration process of cryogenic propellants for launch vehicles. The 
process can be described at the top level as a heuristic process in that a set of rules and relationships 
were developed based on the limited data that is available from prior accidents and tests. The majority of 
the detailed relationships for liquid rockets come from a test performed with a Saturn IVB performed 
under project PYRO. Since the process is largely empirical and heuristic, the algorithm developed 
improved dramatically with larger databases and therefore there is a strong desire to obtain detailed data 
from any related accident or test. 

The small-scale tests developed to observe fragmentation consist of a two stage cannon that 
functions like a shock tube. The first section is used to generate the blast wave that simulates and/or 
envelopes the blast waves observed in accidents and tests. The resulting blast wave is released into the 
second section that can be filled with various media to simulate liquid filled and partially filled structures or 
can be left unfilled to simulate empty structures. Liquid Nitrogen was used in some testing to examine the 
impact of the flash evaporation and the cold temperatures on the fragmentation process. Fragments were 
produced and measured for both aluminum alloys and stainless steels. The current database is limited to 
thin walled samples due to the small bore size (6 inch internal diameter) of the cannon and the need to 
maintain the blast overpressures within the range that are possible in a launch vehicle accident. 

Therefore no pressures above 480 psig were used. Future testing will address actual flight thickness 
materials and samples with a large 12-inch diameter cannon since the fragmentation process is non- 
linear and must be addressed for actual thicknesses. 

Figure 3 presents a view of the 6-inch cannon producing fragments under the influence of a blast 
wave. The photo shows the fragments being accelerated after the sample breaks apart. Figure 4 shows a 
summary of the results for accelerating the fragment under various modes. In general the presence of 
liquids reduces the fragment energies for the test conducted. Extrapolation of these results to large 
systems is not complete. However the trend does indicate additional investigation is clearly warranted. 




Figure 3 - Photos show Fragments being Accelerated and Recovered for Analysis 
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Figure 4 - Fragment Speed/mass Designated by Test Configuration 

The early results of the small scale tests were instructive to the heuristic process used based on the 
empirical data. Some of the key findings to date include: 

• Small fragments are unlikely to be produced from these blasts 

• Liquids reduced the number of fragments produced with obvious differences showing in samples 
with half liquid and half ullage gas. The gas side produces considerably more fragments than the 
liquid side. 

• Aluminum alloys tend to produce larger fragments that stainless steels 

• Acceleration by blast waves produces the highest energy fragments 

• Flash evaporation appears not to be effective at accelerating fragments. 

A pair of programs call Liquid Propellant Fragment Overpressure Acceleration Model (L-FOAM) 
and Solid Rocket Propellant Overpressure Acceleration Model (S-FOAM) have been developed that 
allows a user to develop a fragment catalog based on the empirical data in the database and the specific 
design of the launch vehicle. Both versions of the program allow the user to generate fragment catalogs 




in the form of probability distribution of fragments with sizes and initial velocities defined. Details of how 
the program works are found in the discussion in reference [17]. The number of Monte Carlo cases are 
defined by the users and the distributions of the fragments are based on variances in vehicle state, 
velocity, altitude and the type of explosions to be considered. Due to wide variances in explosion 
magnitudes that can occur, the user is allowed to select the mean and upper bounds or they can use 
those defined by the work discussed above. One should remember that the worst-case liquid rocket 
explosion assumes a detonation which has never been observed in any test or accident to date. These 
programs are maturing but still require significant user expertise to utilize appropriately. 

Several observations can be made from the early result of this work. First, solid rocket motors can 
produce fragments with an order of magnitude higher kinetic energy than launch vehicles that use liquid 
propellants. The simplicity and reliability of solid rocket motors are well established. The solids can be 
made considerably safer for cases where in flight destruction by the flight termination system is required. 
This is the most likely catastrophic failure for most solids and there are established mechanisms such as 
blow out ports/vents that can reduce the work pressures prior to destruction that would reduce the kinetic 
energy of the fragments. This is counter to well-founded desires by the range to provide for total 
destruction of the rocket motor to avoid large propellant masses to impact the ground that can lead to 
secondary detonations that are more energetic than the original destruct event. Additional research is 
warranted in these areas to reduce the risk to the crew as well as the range. 

Other observations have to do with the propellant mass of the vehicle during a catastrophic 
failure. The system models will need to address propellant mass and ullage areas to determine the 
fragment generation and acceleration. 

THERMODYNAMICS OF FIREBALLS 


To reduce the uncertainty of simulations of launch vehicle explosions, a total energy balance is 
desired. However this is only practical for ideal cases. The explosions are considered an “open system” 
meaning that there are no boundaries in which to contain all of the products/reactants of the explosion. In 
any explosion of a launch vehicle there will be considerable losses of the propellant to evaporation, 
mechanical disbursement and the chaotic nature of the explosion creating regions which will be outside 
the flammability limits. Where low vapor pressure, high evaporation temperature fuels like RP are used 
the fuel can pool and produce low rate combustion for long periods (hours). Other losses for these kinds 
of fuels include absorption of the fuel into the ground, or the fuel can flow out of the combustion zones. 
However, the team is developing models for ideal explosions to determine where the energy is being 
consumed to allow the vehicle and pad designers to assess risks outside the immediate area of the crew 
such as downwind of the pad. In addition, an effective energy balance increases the confidence that all 
aspects of the combustion /explosion are being addressed in whole. 

This work is less mature than any other area but Table 4 provides a first order assessment of the 
energy consumed in the various HOVI tests. The team used ideal relationships for estimating the energy 
consumed by the thermal energy release, the energy consumed in the blast wave, and compared that to 
the available chemical energy in the propellants. This ignores several significant sources including the 
phase change, and the kinetic energy from the impact. This was not intended to be a total energy 
balance like that desired for an ideal explosion. HOVI test 9 produced the largest over pressures of any 
of the tests and consumed more than 20% of the total energy available in the blast wave. All of the 
remaining tests appear to have less than 2% of the energy consumed by the blast events. It should be 
noted that HOVI 9 had the longest mix time prior to the ignition of the mixture. This implies the HOVI 9 
test had the potential for more of the propellants to mix prior to ignition. The thermal energy is two orders 
of magnitude greater than the blast energy except for HOVI 9 where the ratio drops to a factor of 3. 
However the current efforts indicate that a significant percentage of the chemical energy is released as 
gaseous propellants that escape the blast system without being combusted. Table 4 provides some 
insight as to where the energy may be going but much of the available chemical energy is probably 
escaping the explosion system volume. The amount of energy in the blast wave is ~3 orders of 



magnitude smaller than the available combustion energy except for the HOVI 9 test where the blast wave 
consumed 21% of the energy. 
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Table 4 - First Order Energy Estimates for HOVI Test Series 

Unlike RP-1 , hydrogen is highly diffusive and highly buoyant. It rapidly mixes with the ambient air 
during any accidental release. The diffusion velocity is directly related to the diffusion coefficient which 
will vary with temperature, T n , with n in the range of 1 .72 to 1 .8. The temperature of the hydrogen will 
vary over a wide range from the initial liquid state and goes through a phase change and rapid expansion 
while being exposed to a hot radiative environment once a combustion event begins [19]. 

Besides the rapid diffusion occurring, the hydrogen is driven by buoyancy forces as the hydrogen 
gas temperature approaches the ambient temperature. The velocity under the influence of (positively) 
buoyant forces cannot be determined directly, since it is dependent on the density difference between 
hydrogen and air as well as on drag and friction forces. Mechanical disbursements of the liquids due to 
the accident, the shape and size of the rising gas volume and atmospheric turbulence have an influence 
on the final velocity of the rising gases. Both diffusion and buoyancy determine the rate at which the gas 
mixes with the ambient air. The rapid mixing of hydrogen with the air can quickly dilute the mixture to the 
non-flammable range. Therefore it is estimated that in a typical unconfined hydrogen explosion, a 
significant fraction of the gas mixture cloud escapes the blast event system. This further reduces the 
theoretically available energy. 

The fireballs produced for pad or near pad accidents can become very large due to the large 
amount of propellants that are available for combustion. Figure 5 provides an estimate of the fireball 
radius as a function of propellant mass based on accident data available. This is a curve fit to the data 
that is considered appropriate for the launch vehicles under consideration. The initial blast event is a 1 to 
5 milliseconds event but the fireballs are a long duration combustion event and can be observed for 
durations of up to 16 seconds after a vehicle accident. The burn duration is a function of the mass of the 
propellant and the energetics of the accident. Figure 6 provides an estimate of the burn duration as a 
function of propellant mass. In cases where the initial explosion is relatively small and the entire vehicle 
remains somewhat contained the propellant release is slower and the burn durations can be longer. Still 
the flash evaporation of the uncontained cryogenics is very fast with rates of liquid hydrogen flash- 
evaporation at 280 kg/second [18] observed in hydrogen spill tests. A statistical approach was used to 
define a burn duration of the fireballs using the accident database described earlier. These burn durations 
become important when the vehicle designers and crew systems designers must assess the use of 
parachutes near the fireball. In the case of the SLS/MPCV program the burn duration is on the same 
order of time that occurs between the crew escape sequence and parachute deployment. It is unlikely 
that they overlap but when possible destruct time delays are accounted for, the issue becomes 
problematic and must be assessed however unlikely. 


Future updates of these curves will be made as the entire project matures. Total energy balances 
will be used to assess how much of the propellants may be escaping by mechanical expulsion, by 
evaporation and by gravitational flow. At present the team considers the energy balance an open 
consideration requiring additional investigation. 



Figure 5 - Radius of the Fireball for Pad or Near Pad Explosions 



Figure 6 - Fireball Durations for Pad or Near Pad Accidents 


TIMING 


When one considers an explosion, the initial perception is that the event would occur near 
instantaneously. A review of historical accidents of launch vehicles indicates a wide range of times 
between when the initial failure occurs that propagates to the explosion and when the actual explosions 
occurs. Figure 7 provides a break out of the lead times between the event and the initial indication of the 
failure. There is some subjective data used to develop the lead times due to the lack of detailed failure 
data for all of the launch vehicle failures. The data indicates that approximately 1 8% of the accidents 
historically provided less than 0.5 seconds of warning or lead-time. The remaining accidents had more 
time between the initial failure and the explosion including one case where the lead-time approached 1 
minute. This database has been expanded to more than 30 accidents but additional work is needed to 
resolve ambiguity in the warning times. The new database is also being assessed to determine if the 
current SLS abort logic would have detected the failures. The data is conservative in that in most cases 
where actual failure reports did not provide the data, then visual indications were used. Due to the low 
resolution of the video there was a judgment call as to the lead-time and the approach was intended to be 
conservative so as not to overstate the success of the abort logic. Most solid rocket failures are very rapid 
with STS-51 Challenger SRB leak/containment failure being an exception. 


Warning Time From Historic Pad Accidents 



■ On the rocket (0.0 sec) 


■ In the fireball (0.0 toO.S sec) 


• Significant blast wave interaction (0.5 to 3.5 sec) 


H Beyond significant blast effects (>3, 5 sec) 


Figure 7 Warning Times from Prior Accidents show a Wide Distribution of Lead-times 

The results provide some insight as to the true nature of the launch vehicle explosions. They can 
be very rapid events. However, the majority of accidents appear to progress at a rate that enables the 
onboard systems or the crew to make a good decision to abort and escape the launch vehicle. Further, 
there is some indication that a very rapid event is likely to be a low yield explosion since the ability to 
effectively produce a high yield mixture is limited. One case of a rapid event is the so called Confined By 
Missile (CBM) explosion that is used to simulate worst case events but historically have been low yield 
events due to the auto-ignition phenomena discussed earlier. Prior work assumed that the propellant 
would mix well leading to very large events. While these results are generalizations and should be 
interpreted with caution they do indicate a trend that should have some applicability for similar 
configurations of launch vehicles. 


TEST PROGRAM PLANNING 


Additional research is planned over the next year including maturing the blast and fragmentation models 
at vacuum conditions and expanding the small scale testing. Long term larger scale testing is needed to 
achieve the next level of validation for system level models. Expansion of small-scale testing has been 
funded and is planned over the current fiscal year. Long-term planning discussions are actively occurring 
with various agencies and industry representatives. All testing and analytical work is being done in 
parallel with computational efforts to ensure test plans can validate system-level simulations and provide 
for the lowest uncertainties. 

The three primary objectives for the next phase of testing consist of larger scale balloon testing to assess 
flame acceleration effects, assess high-energy ignition effects and examine non-homogeneous mixtures. 
Table 5 presents a preliminary test matrix for the fiscal year 2015 testing. These are categories of tests 
and the specific tests will be defined in the near future. In general tests are repeated multiple times in 
random fashion consistent with design of experiments (DOE) practices to minimize random errors, test 
biases and systematic errors being introduced into the process. The design of experiments practice 
allows the team to minimize testing in order to reduce costs and minimizes the effects of wear and tear on 
the test hardware, repetitive tasking errors and so on. Table 5 also presents tests used to assess flame 
acceleration effects from materials that will be present on the launch vehicle services. Consideration is 
being given to introducing well-defined obstructions inside the balloon to examine flame acceleration 
effects due to obstructions. In addition the goal is to increase the data available from regions inside the 
blast zones /balloon. 


Type 

Objective 

Comments 

Larger Volume / Characteristic 
Length 

Flow acceleration as volume increases and 
investigation of internal pressure dynamics and 
flame speeds 

Addresses length related flame 
acceleration and internal data provides 
insight into blast wave development 

Alternate Ignition Sources 

Test ignition by large pressure increases, high 
energy spark, high-energy detonations (pyros) 

Better define what drives DDT and 
assess alternate ignition sources 

Non-homogenous mixtures 

Examine flame speed and overpressures due to 
non-ideal mixtures 

Requires multiple balloons tied together, 
common volume is impractical due to 
inability to define actual mixtures by 
zone. 

Blast reflection validation 

Provide for a single reflection from wall to validate 
blast propagation model for hydrogen/oxygen blast 

Purpose is to validate blast propagation 
computational simulations 

Material Effects to flame 
acceleration 

Assess flame speeds that would occur near the 
vehicle surfaces under the influence of the surface 
insulations. 

Provides insight as to what will occur at 
the surface of the vehicle. 

Obstructions 

Develop flame acceleration models for simple 
obstructions 

Attempt to better understand the 
potential for DDT in main engine 
compartments 


Table 5 - Current Blast Physics Test Plans for Fiscal Year 2015 

Table 6 presents a preliminary test matrix for the planned fragmentation testing. The initial series of each 
test series consists of duplicate/replicated tests from the smaller 6-inch cannon testing for benchmarking. 
These tests will allow direct one-to-one comparison between actual flight thickness materials and the thin 
material samples from the prior test series. Initial tests will address smooth walled materials followed by 
materials representative of the typical ortho-grid walls used in propellant tank construction. In addition, 
tests will be conducted using representative materials with thickness transitions and welds. It is unlikely 
the team will complete the entire test series in fiscal year 2015 due to limited resources available and 
longer setup times for the larger components of the 12 inch cannon. 


Type 

Objective 

Comments 

Design 

• Smooth wall panels 

• Otho-grid at constant thickness 

• Panels with welds 

• Panels with material thickness transitions 

explores the impact of the material design 
on the fragment generation 





Working fluids/gases 

• Gas ullage from ambient to 60 psig 

• Liquid (water) various fill levels 

• Liquid Nitrogen various fill levels to assess 
temperature effects 

Provides additional acceleration effects 
data with actual flight materials. 

Materials 

• Al-Li 

• Stainless Steel 

Addresses the two primary tank materials in 
use for EM-1 . Composites desired but not 
justified for current SLS configuration 


Table 6 Current Fragmentation Test Plans for Fiscal Year 2015 

The small-scale testing has proven to be a very valuable tool to understand the underlying physics that 
are occurring during these kinds of explosions. This small-scale testing, when combined with the 
knowledge obtained from larger scale testing conducted under the PYRO and HOVI programs, allow the 
team to significantly enhance knowledge of a launch vehicle explosion. However, the small-scale tests 
require extrapolating results to support large-scale system simulations. Larger scale tests are required to 
ensure fragmentation models are properly representing the initial velocities and directions of fragments. In 
addition, the effect of the phase change from the cryogenic propellant is very difficult to address with the 
small-scale tests and would be easier to address with larger scale tests such as those currently being 
planned. 


SUMMARY AND CONCLUSIONS 


While the work is not complete, early trends appear to indicate that most launch vehicle accidents and 
explosions are survivable for in-line vehicles. There will be some launch vehicle explosions that may not 
be survivable. The goal here is to define the blast environments and allow vehicle and crew systems 
designers to eliminate or minimize configurations that can lead to explosions that are not survivable. In 
addition, this development program is being designed to support engineering risk and probability risk 
assessment tools to provide more realistic estimates and characterizations of the actual risk to the crew. 

The philosophy of the research and test program is to build on the knowledge gained at each step in the 
program. Engineering models and computational simulations are prepared at each step in order to ensure 
that the engineering team has a firm understanding of underlying physics. The larger scale tests, similar 
to those that have been conducted, combine multiple parameters and variables that become difficult to 
isolate without a firm understanding of the individual parameters involved. It is the integrated 
computational models, and analyses with small and large scale testing that allows the team to provide the 
necessary data for the future launch vehicle design industry. Even large-scale testing will have limited 
validation capabilities since the test must envelope a large number of failure modes. The objective is not 
to develop high fidelity models to represent a given/specific explosion but to create data and knowledge 
of launch vehicle explosions, fragmentation generation / acceleration and thermal dynamics of fireballs 
such that launch vehicle designers can develop robust crew escape systems. An excellent analogy is the 
crash testing of modern automobiles. The car manufacturers’ knowledge of the crash dynamics allows 
them to design vehicles to reduce occupant injuries. For real world automobile accidents your 
manufacturers must rely on the safety systems to perform similarly to the way they performed in the crash 
testing. It will be unrealistic to expect crew safety systems to ensure the crew survives all possible 
accidents that result in an explosion just as the automobile manufactures do not accommodate all 
possible accidents. Data collected from this ongoing effort appears to indicate that most (not all) launch 
vehicles accidents are survivable if the developers design to accommodate the environments. Therefore 
crew safety systems designers should be addressing other factors that may influence safety and success 
of crew safety systems. 

A review of current vehicle system models indicates that many are using worst case assumptions in the 
guiding principle that if the crew can survive these worst case assumptions then safety is assured. Of 
course it is not practical to design for the worst case assumptions for an explosion and the concern is that 




the vehicle designers overestimate the crew demise for an accident when evidence indicates that in most 
cases the crew could survive. This overly conservative approach will hide the real threats to the crew by 
over predicting their demise due to an explosion and then ignore the aspects that may lead to their actual 
fatalities. The objective of the work here is to provide the vehicle designers the means to understand the 
real risks to the crew from explosions and to allow them to design for survivable accidents. 

FUTURE WORK 


This effort is an ongoing task that will continue to expand the knowledge base for launch vehicle 
explosions. Development work will continue to expand the knowledge of the mechanics of the blast 
events including impacts due to size, ignition sources, non-homogenous mixtures and obstructions. 
Fragmentation development work will explore actual flight materials and attempt to address the 
mechanisms that are accelerating the fragments. Large scale tests and limited flight tests are being 
proposed that are cost effective but generic enough to apply to all current configuration of launch vehicles 
being proposed for human flights. 
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